Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
evince
New Contributor

How to debug gre tunnel

Dear all,

 

I'd like to debug my gre tunnels, what are the commands to do?

 

Thank you in advance,

 

Bests Regards,

5 REPLIES 5
Rewanta_FTNT
Staff
Staff

Hi,

 

you can view the gre tunnel status using the following commands

 

diag netlink interface list name <gre-tunnel-name>

get sys interface

 

as long as the you assign the valid tunnel source, gre tunnel comes up. there is no gre keepalive packets fgt send like cisco routers. 

 

HTH.

 

evince
New Contributor

Hello,

 

Thank you very much for your help. If i understand, when i run this command, the tunnel should come up? 

 

Btw, how can i debug if my tunnel won't come up?

 

Bests Regards,

emnoc
Esteemed Contributor III

You can using any of the diag sniffer commands

 

e.g

 

 

diag sniffer packet <interface name that virtual gre tunnel is bound to> " proto 47"

or

 

diag sniffer packet <interface name that virtual gre tunnel is bound to> " src host 1.1.1.1 dst host 2.2.2.2"

 

or

diag sniffer packet <interface name that virtual gre tunnel is bound to> "host 1.1.1.1 and 2.2.2.2"

 

If you you see no packet reaching you with the tunnel remote-addres or if you have no tunnel leaving your interface with the destination address, than recheck your config and routing.

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
evince
New Contributor

Hello emnoc,

 

Thank you for your support, i'll try this.

 

Bests Regards,

Rewanta_FTNT
Staff
Staff

<< Thank you very much for your help. If i understand, when i run this command, the tunnel should come up? >>

 

the following commands are just to check if the gre tunnel is up or down

diag netlink interface list name <gre-tunnel-name>

get sys interface

 

You can also try ping to other side of gre tunnel ip once the tunnel comes up.  Btw, how can i debug if my tunnel won't come up?

->make sure tunnel-source has valid IP sourced from another valid interface.

-> source IP interface in the gre tunnel is UP-up state. 

 

you may follow the link for the gre config

[link]http://docs.fortinet.com/d/fortigate-ipsec-vpn-1[/link]

 

if the traffic cant pass after the tunnel comes up, you can use sniffer command suggested by emnoc. 

 

Rewanta

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors